Stored XSS in Discourse Topic Featured Links

Executive Summary

This vulnerability exists in the Discourse open-source discussion platform prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5. It involves the "featured link" in a topic, which was not properly normalized and escaped before being displayed in the topic list. Because of this insufficient sanitization, a user who has the ability to set a featured link could inject JavaScript code if the default Content Security Policy protections are modified or disabled.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is a stored cross-site scripting (XSS) issue in the Discourse forum software related to the "featured link" in topics. Detection involves identifying if your Discourse instance is running a vulnerable version prior to 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5, and whether the default Content Security Policy (CSP) has been modified or disabled.

To detect exploitation attempts or presence of malicious featured links, you can inspect the topic lists for suspicious JavaScript code embedded in featured links.

Suggested commands or steps include:

• Check the Discourse version installed by running: `bundle exec rails about` or checking the version in the admin dashboard.
• Review the Content Security Policy headers sent by your server to ensure the default CSP is enabled and does not include 'unsafe-inline' in the script-src directive. You can use curl to check headers: `curl -I https://your-discourse-site.com` and look for the Content-Security-Policy header.
• Search the database for featured links containing suspicious JavaScript or unsafe characters. For example, if you have database access, run a query like: `SELECT id, featured_link FROM topics WHERE featured_link LIKE '%<script>%' OR featured_link LIKE '%javascript:%';`
• Monitor web traffic or logs for requests that include suspicious payloads in featured links or unusual script execution in topic lists.

If you find any suspicious featured links or your version is vulnerable and CSP is weakened, it is recommended to upgrade to a patched version or disable the topic_featured_link_enabled setting until patched.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows a user with permission to set a featured link to inject malicious JavaScript code into the topic list view. This can lead to cross-site scripting (XSS) attacks, potentially compromising the security of users viewing the topic list. The impact depends on whether the default Content Security Policy protections are altered or disabled, which would otherwise mitigate such attacks.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows a user who can set a featured link to inject JavaScript when default Content Security Policy protections are modified or disabled. This could potentially lead to unauthorized actions or data exposure.

Such unauthorized script injection could impact compliance with standards like GDPR or HIPAA, which require protection of personal data and secure handling of user information, by increasing the risk of data breaches or unauthorized data access.

However, the provided information does not explicitly describe the direct impact on compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update your Discourse installation to one of the fixed versions: 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5.

Additionally, ensure that the Content Security Policy (CSP) protections are enabled and not modified or disabled, as the vulnerability relies on CSP being weakened.

Useful 0 Not Useful 0